Refactor verifyNewBundle into library function

[codysoyland]

Summary

This is a refactor of the bundle verification logic that replaces verifyNewBundle with a re-written library function cosign.VerifyNewBundle, which accepts a simplified set of arguments, using CheckOpts to supply the majority of the configuration. It has been moved out of the cli package into the cosign package and made public.

This is partially extracted from #3889.

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 47.14286% with 111 lines in your changes missing coverage. Please review.

Project coverage is 36.43%. Comparing base (2ef6022) to head (ac686eb).
Report is 278 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/verify/verify_blob.go	33.70%	48 Missing and 11 partials ⚠️
cmd/cosign/cli/verify/verify_blob_attestation.go	41.50%	26 Missing and 5 partials ⚠️
pkg/cosign/verify.go	74.13%	10 Missing and 5 partials ⚠️
pkg/cosign/verify_bundle.go	40.00%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4013      +/-   ##
==========================================
- Coverage   40.10%   36.43%   -3.67%     
==========================================
  Files         155      210      +55     
  Lines       10044    13351    +3307     
==========================================
+ Hits         4028     4865     +837     
- Misses       5530     7874    +2344     
- Partials      486      612     +126     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codysoyland]

@haydentherapper @cmurphy @steiza I would appreciate a look at this whenever you have a moment!

[steiza]

Nice work! I don't have any further comments other than the things already raised by @malancas.

[codysoyland]

I will take a look at the conformance failures Monday. Thanks all!